36 ms·
You're making bad assumptions and your logic doesn't hold water. I have very much worked on teams responsible for protecting computers from breaking zero days.
by djcapelis 13y ago
You're making bad assumptions and your logic doesn't hold water. I have very much worked on teams responsible for protecting computers from breaking zero days. Most memorable for me was probably when the Debian SSH key generation bug was released. I was there that morning, writing a scanner to find all the vulnerable machines my team was responsible for (and actually racing against the scanner a colleague on my former team who had responsibility for the whole org's security was writing) and trying to get them patched as quick as possible. (Most of ours were found and patched by the time my former team put up their version of the list out, and another bunch had been patched before their scan even got to them, so we did a good job that day.) What I'm trying to say is, I know exactly what it's like. That operational experience informs my work today even though I don't have a large operational role for many machines these days. (I'm only responsible for about 40-60 machines now.)
That all aside, the job of the security community is not to make your life or my life easier. And neither you or the person I was replying to gets to be angry at someone for exposing a problem because it inconveniences you or your colleagues.
The only thing that will do you any good is to fix your shit.
Pretending that it is someone else's fault that you have to scramble to fix your shit is not okay. I think my comment was phrased bluntly, but was both truthful and appropriate. I understand the emotions that cause it, but no one who blames others for their own problems has much high ground to stand on when it comes to empathy.